···11+<p align="center">
22+ <img src="assets/tobi.svg" alt="" width="100%">
33+</p>
44+15# tobi
2637ACPI AML decompiler that reads raw AML blobs and DSDT/SSDT tables, skips validated ACPI headers, and builds its own IR while doing conservative CFG recovery over package bounded control operations, then emits pseudocode, opcode disassembly, JSON IR, raw table metadata/Graphviz CFG view
···2125./build-san/fz
2226```
23272828+For a bounded libFuzzer pass with the checked-in seed corpus:
2929+3030+```sh
3131+cmake -S . -B build-libfz -DCMAKE_C_COMPILER=clang -DTOBI_LIBFUZZER=ON -DTOBI_WERROR=ON -DTOBI_FZ=OFF
3232+cmake --build build-libfz --target fz_llvm
3333+rm -rf /tmp/tobi-fuzz-corpus
3434+mkdir -p /tmp/tobi-fuzz-corpus
3535+cp fuzz/seed/*.aml /tmp/tobi-fuzz-corpus/
3636+./build-libfz/fz_llvm -runs=256 /tmp/tobi-fuzz-corpus
3737+```
3838+2439## Usage
25402641```sh
···2843```
29443045```text
3131---dis print opcode disam
4646+--dis print opcode disassembly
3247--json print parsed IR as json
3348--dot print recovered CF as Graphviz DOT
3449--raw print input/table metadata and AML offsets
···6378./build/tobi --json sam/m0.aml
6479```
65808181+JSON contains the aggregate parse metadata in `meta`, per-input metadata in `inputs`, source-aware diagnostics in `diagnostics`, the discovered namespace, and the deterministic IR tree. Multi-input parses keep each file/table as a named IR block and diagnostics include `source` plus `input_index` when the input name is known.
8282+6683CFG view:
67846885```sh
6986./build/tobi --dot sam/m1.aml
7087```
71888989+Visualise any user supplied AML blob or ACPI table with Graphviz:
9090+9191+```sh
9292+./build/tobi --dot path/to/input.aml > input.dot
9393+dot -Tsvg input.dot -o input.svg
9494+firefox input.svg
9595+```
9696+9797+For one command:
9898+9999+```sh
100100+./build/tobi --dot path/to/input.aml 2>/dev/null | dot -Tsvg -o input.svg
101101+```
102102+72103Multiple AML inputs share one namespace pre pass before parsing:
7310474105```sh
···99130raw opcode for unknown or opcode expression nodes
100131deterministic child array
101132```
133133+134134+Currently covered AML surface:
135135+136136+```text
137137+name/scope/device/method/external/alias objects
138138+opregion, field, indexfield, bankfield, mutex, event, processor-style objects
139139+integer/string/buffer/package values and common arithmetic/logical/conversion expressions
140140+method calls resolved through a namespace pre pass, including forward and multi-file calls
141141+IfOp, ElseOp, WhileOp, ReturnOp, BreakOp, ContinueOp
142142+resource-template item summaries inside buffer objects
143143+```
144144+145145+Unsupported or ambiguous opcodes are preserved as explicit `unknown` IR nodes with byte offsets and diagnostics. Pseudocode is intentionally conservative: it is an inspection format, not recompilable ASL.
102146103147## Control flow
104148